Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-4961
8.8 HIGH
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow
A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
References
-
VDB-353838 | Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow vdb-entrytechnical-description
-
-
Submit #777617 | Tenda AC6 AC6 V1.0 V15.03.05.16 Buffer Overflow third-party-advisory
-
https://www.tenda.com.cn/ product
Affected products
AC6
- ==15.03.05.16
Matching in nixpkgs
pkgs.replay-node-cli
Time Travel Debugger for Web Development - Node Command Line
-
nixos-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-unstable 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-unstable-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
-
nixos-25.11 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixos-25.11-small 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
- nixpkgs-25.11-darwin 0.1.7-20220726-bac6d66b5ca1-5b966f2f136c
pkgs.tests.haskell.upstreamStackHpackVersion
Test that the stack in Nixpkgs uses the same version of Hpack as the upstream stack release
Package maintainers
-
@phryneas Lenz Weber <mail@lenzw.de>
-
@cdepillabout Dennis Gosnell <cdep.illabout@gmail.com>